Only those individuals authorized to have access to any particular system or location, referred to herein as "destinations", should be granted such access. Indeed today, many destinations may be remotely accessed via telecommunications. Typical remotely accessible destinations include remote telephones, systems that provide access to credit and systems that provide value-added telecommunications services. On a regular basis, a large number of authorized individuals must authenticate their identity, i.e., to confirm that the person requesting the access is actually who he alleges that he is, to several destinations to which access is sought.
Typically each destination has its own systems and procedures for authenticating its authorized users. The resulting plurality of authentication systems is expensive. Also, each authentication system must keep a copy of all the information necessary to identify each of its authorized users, thereby creating large storage demands. Further, the compromising of a copy of an individual user's information that is required for access to one system tends to compromise the information contained in other authentication systems. This results because authentication systems tend to require the same basic information. Also, the number of copies of the information increases as the number of destinations to which the user may obtain authorized access increases. Since each copy is independently vulnerable to attackers of the system, the overall likelihood that any of the copies will remain secure decreases. In addition, each authentication system must be secured physically, as well as logically, against attackers which adds additional expense. These problems can be called the problems of a wide security perimeter.
From the viewpoint of a user, a plurality of authentication procedures is cumbersome and repetitive. The perceived constant requirement to comply with security arrangements encourages users to choose trivial identification means. The user typically deals with the most common security requirement of supplying a personal identification number (PIN) by employing an easy-to-remember PIN, such as a birthday, and employing the same PIN for each destination. Choosing the same PIN for each destination results in the undesirable effect that when one destination is compromised, all of the destinations are immediately compromised. Further, in selecting and easy-to-remember PIN, a user almost invariably selects a PIN that is easy to arrive at by guesswork or simple trial and error methods.
Another problem with prior security systems is how to manage the diverse security needs of a plurality of destinations and a plurality of authorized users. In particular, there is a need to insure that the ultimate bearer of the cost of erroneous access is capable of specifying the authentication level, i.e., the level of confidence of the accuracy of an identification, employed for any particular access. Each particular destination may have its own requirements as to the authentication level that is necessary before any particular level of access can be granted. In addition, a particular authorized user may wish to specify an authentication level that should be met before access is allowed for a request that alleges that user's identity. Prior security systems do not provide mechanisms for security level control by the user. Furthermore, if the access control is specified directly at the destination, the problems associated with a wide security perimeter result.
In order to actually authenticate the identity of an access requester, prior systems have made use of representations of various different identifying characteristics of a person. Identifying characteristics that have been employed include: voice samples, fingerprints, retina patterns, personal appearance, handwriting and even the manner in which a wave is polarized as it passes through a portion of the body. Such representations are known as authentication information. These prior systems obtain an identity that is alleged by the access requester. One method employed to obtain such an alleged identity is to require the requester to enter some type of a code. This code may be typed in via a keypad or scanned from a device in the requester's possession. The prior systems then attempt to authenticate that the requester is actually the individual whose identity was alleged by comparing a measure of the authentication information that has been previously stored with a measure of the same authentication information that is taken from the requester during the access request process. If the result of the comparison is that the stored authentication information matches the authentication information taken from the requester during the access request to within a predetermined limit the allegation of identity is confirmed and access is granted. Otherwise, access is denied.